This Week in Cybersecurity: Week 42

The most serious story this week was not, as far as anyone has shown, a software bug. Attackers got hold of a credential belonging to ConnectWise Cloud Backup, a backup service that IT providers install into their clients' Microsoft 365 accounts, and used the access that app already had to sign in to customer tenants. Huntress confirmed unauthorized sign-ins in 173 tenants, and later counted about 300 successful sign-ins out of almost 1,000 tenants touched. ConnectWise has switched the service off. ConnectWise says it is still unclear whether a product flaw played a part, but the core of the attack is plain: the attackers borrowed a key that organisations had handed over on purpose.

Around it, a heavy week. Microsoft shipped a record 1,413 fixes, including one Windows flaw already used in attacks. Ivanti, Cisco, BeyondTrust and Palo Alto Networks all disclosed flaws that attackers were exploiting before or as the patches arrived, and one of the three Ivanti bugs still has no fix. A security firm used a public AI model to build a full Chrome exploit chain in six days. For consumers, the useful actions are short: install the Windows updates, update WinRAR by hand, be careful where you buy a hardware wallet, and be wary of cheap no-name Android phones. This roundup covers Monday 12 to Sunday 18 October.

If you missed it, last week's roundup covered the 8.8 million Danish ID records pulled through one company account, rogue Google certificates from hijacked registries and two more NetScaler flaws.

What to act on#

Install the October Windows updates#

Microsoft's October Patch Tuesday fixed 1,413 vulnerabilities, the largest monthly release on record, with more than 70 rated critical. One is already being exploited: CVE-2026-96951, a Windows Shell flaw that lets a crafted file or link slip past Mark of the Web, the label Windows puts on downloaded files so it can warn you before they run. It still needs you to open the file or click the link, which is exactly what a phishing email asks you to do. CISA gave US federal agencies two days to patch it.

A second fix is worth knowing about even though nobody has reported attacks. CVE-2026-21413, a 9.8-rated flaw in the Raw Image Extension, can run code when Windows simply draws a thumbnail of a crafted RAW photo in a folder you browse. You do not have to open the file.

What to do: open Settings, then Windows Update, install everything offered and restart. If you are on Windows 10 without extended security updates, these fixes do not reach you, and that is the strongest argument yet to move on.

Update WinRAR by hand - it does not update itself#

A group known as Silent Lynx is using a WinRAR flaw in attacks on government organisations across nine former Soviet states, sending crafted RAR archives that drop a backdoor into the Windows Startup folder. The flaw, CVE-2025-8088, is more than a year old: RARLAB fixed it in WinRAR 7.13 in July 2025. It keeps working because WinRAR has no automatic updates, so millions of copies are still on old versions.

What to do: in WinRAR, open Help, then About, and check the version. Anything below 7.13 needs replacing with the current release from the official RARLAB site. Windows 11 can open RAR files natively if you would rather uninstall it.

Bought a hardware wallet in Southeast Asia lately? Don't set it up#

Ledger found a hardware implant inside a device sold by CryptoBilis, one of its own authorised resellers in Indonesia and Malaysia. The implant sits inside the case, reads the screen during setup, captures the 24-word recovery phrase and sends it out over a built-in mobile connection. The wallet's secure chip and software were untouched, which is why the device looked normal. Ledger has paused CryptoBilis and asked resellers across Southeast Asia and Hong Kong to stop selling. A blockchain investigator puts losses above $86 million; Ledger has not confirmed a figure and calls the impact "limited".

What to do: if you bought from that reseller in the last 90 days, do not set the device up. If you already did, move your funds to a new wallet with a freshly generated recovery phrase. For everyone else, buy hardware wallets direct from the manufacturer, and never type or photograph your recovery phrase anywhere except on the device itself.

Cheap no-name Android phones and fake "update" prompts#

Two Android stories point the same way. Bitdefender found malware preinstalled in the firmware of low-cost MediaTek phones, often white-label or counterfeit models dressed up with Samsung Galaxy or iPhone names. The hidden component runs with system privileges, installs dozens of disguised apps, commits ad fraud and rents your internet connection to strangers as a "residential proxy". It cannot be uninstalled because it lives in the system partition. Separately, ThreatFabric described Hirudo, a banking trojan that arrives through shopping and video apps installed outside Google Play, which then push a fake in-app "update". It steals logins, card PINs and text messages, and for eight Indonesian banks it swaps in tampered copies of the real banking app.

What to do: buy phones from known brands that still ship security updates, from sellers you trust; a "Galaxy" at a third of the price is not a bargain. Install apps only from Google Play, ignore update prompts that come from inside an app instead of the store, and refuse Accessibility access to anything that is not an accessibility tool. Our Android hardening guide walks through the settings.

The week's biggest#

ConnectWise Cloud Backup: one stolen app credential, hundreds of Microsoft 365 tenants#

ConnectWise Cloud Backup (formerly SkyKick) backs up Microsoft 365 and Google Workspace data for managed IT providers and their clients. To do that, its app is granted wide access to mail, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed. Attackers obtained one of the app's credentials and, on 15 October, used it to request access tokens and walk through customer tenants a few seconds apart, in what Huntress said looked like a script working down a list. Microsoft called it "an active supply chain attack". In at least one tenant, a related ConnectWise management app added itself to the Global Administrator role and planted new secrets in other trusted apps, a way of keeping access after the original route is closed.

By Saturday ConnectWise had disabled seven application identities, suspended Cloud Backup and taken its SaaS Security and Cloud Management products offline. Huntress now counts almost 1,000 tenants with sign-in activity from the attacker's address and about 300 successful sign-ins. A narrower second wave aimed at 16 tenants in policy, national security, trade and critical minerals did not succeed. ConnectWise says backup archives were not accessed and that it still does not know how the credential leaked. Its own warning is the important part: switching the app off "does not reverse changes previously made inside a tenant", and tokens already issued can stay valid for a while.

This is the pattern we keep coming back to in what actually breaks company security: the dangerous access is often the access you granted deliberately, to a vendor, and then stopped thinking about.

Who's exposed: organisations whose IT provider uses ConnectWise Cloud Backup, SkyKick or ConnectWise Cloud Management, including old, forgotten SkyKick connections. If that might be you, ask your provider now whether your tenant was touched, and make sure someone reviews sign-ins since 13 October, new app credentials, admin role changes and mailbox forwarding rules. Individuals with personal Microsoft accounts are not affected.

Ivanti Connect Secure: three chained zero-days, one still unpatched#

Volexity found an attacker chaining three unknown flaws in Ivanti Connect Secure, a widely used corporate VPN, to run commands as root without logging in, on an appliance that was fully patched. Exploitation began on 3 October. Ivanti has fixed the first two (tracked together as CVE-2026-104935) in 22.8R2.5 and 25.1.3.0, but the third, which lifts the attacker to root, will only be fixed "in the coming weeks". In the incident Volexity examined, the attacker stole stored credentials including Active Directory logins and then sprayed passwords across the network. It left no web shell, which makes it hard to spot, and Volexity says Ivanti's own integrity checker misses it. CISA added the flaw to its exploited list with a three-day deadline, and honeypots logged 105 exploit attempts within a day.

Who's exposed: organisations running Ivanti Connect Secure, which means a lot of mid-sized and large companies and public bodies. Patch to a fixed version now, check the indicators Volexity published, and assume any credentials stored on the appliance need resetting. Staff using the VPN have nothing to do themselves.

Cisco's email gateway can be taken over by an email#

Cisco warned of active attacks on CVE-2026-76519, a 9.8-rated flaw in its Secure Email Gateway. A crafted attachment in an ordinary inbound email can write files to the appliance and potentially lead to root commands, without the attacker ever logging in. It needs the File Reputation feature turned on, which is common, and a content scanner package older than 25.3.0.5525. There is no workaround. The scanner update can be applied without a reboot, and the AsyncOS fixes have been out since 14 September. Cisco notes a second flaw from the same September batch is also being exploited.

Who's exposed: companies that filter their email through an on-premises or virtual Cisco gateway. Update the scanner package today and run the compromise check Cisco gives; a compromised appliance should be rebuilt, not just patched. If your email is filtered by someone else, ask them.

BeyondTrust Remote Support: a China-linked group got in first#

A China-linked espionage group Google tracks as UNC5221 exploited CVE-2026-102764, a 9.3-rated flaw in BeyondTrust Remote Support, as a zero-day from 29 August. Remote Support is the tool help desks use to take over employees' computers, so a compromised appliance is a jump-off point into everything it can reach. Mandiant saw the attackers plant a web shell, gain root, harvest stored secrets, move into downstream systems through the tool's own connections and delete logs. Cloud customers were patched by 9 October; self-hosted customers on 24.3.1 to 26.2.3 must apply patch BT26-05-RS by hand, and older versions must upgrade first.

Who's exposed: organisations with a self-hosted BeyondTrust Remote Support appliance on the internet. Mandiant's advice is blunt: any appliance that was reachable on a vulnerable version during the window "should be treated as potentially compromised". That means forensics and a rebuild, not just the patch.

Firewalls again: Palo Alto exploited, and a stealthy Fortinet implant#

Palo Alto Networks patched CVE-2026-0322, a flaw in the PAN-OS management interface that gives root on the firewall, after seeing "very limited exploitation". It needs a logged-in attacker who can reach the management page, which is why Palo Alto keeps repeating that the management interface should only be reachable from a single internal jump host. The same week, Unit 42 described PEERSTITCH, memory-only malware that suspected state hackers planted on FortiGate firewalls at a telecom provider using an older FortiOS flaw (CVE-2025-61624, fixed in April). It hides inside the firewall's own processes, writes nothing to disk and quietly lets specially tagged VPN sessions skip security checks.

Who's exposed: organisations running Palo Alto or Fortinet firewalls, especially with management pages reachable from the internet. Patch, lock the management interface down to internal addresses, and check that no unexpected admin accounts or VPN configurations have appeared.

AOMEI Backupper's own update servers delivered a backdoor#

ManageEngine and Google's Mandiant found that attackers tampered with update files on the servers of AOMEI Backupper, a popular Windows backup program, in bursts of five to ten minutes between May and July 2026. Any copy that checked for an update during those windows received a backdoor called SHINYROAD, which gives a remote shell and can fetch more code. Confirmed victims are organisations in IT services, telecoms and universities across 11 countries, and the real total is unknown. AOMEI says its servers are fixed, but that does nothing for machines already infected.

Who's exposed: anyone who ran AOMEI Backupper with updates turned on between April and July, including home users, although the confirmed targets are organisations. Check Task Scheduler for tasks named RadminComponentRuntime or NitroRuntime; if you find one, treat the PC as compromised and get help cleaning it.

Two Linux kernel flaws that break the wall between virtual machines and their host#

Tencent's lab, using its own AI research system, found Vghost (CVE-2026-74580), a bug in the kernel's vhost component present since kernel 4.11 in 2017. A local user with access to a vhost device can become root on the host, and in one narrower configuration a malicious virtual machine can write into the host's memory. A day later came PwnEscape (CVE-2026-99999, rated 9.3), a networking bug that let code inside a virtual machine read roughly 32 bytes of host memory per packet. That was demonstrated against Vercel's production sandboxes, and code execution on the host was reached in a lab. Neither is known to be exploited. Fixed kernels are out for both, though Ubuntu 24.04 and 26.04 were still waiting on the Vghost fix earlier in the week.

Who's exposed: in practice, cloud and hosting providers and anyone running other people's code in virtual machines or sandboxes, which now includes many AI agent platforms. Ordinary desktop Linux users and people who just use cloud services have nothing to do; their providers do.

A public AI model helped build a $250,000 Chrome exploit in six days#

Security firm XBOW used AI agents running OpenAI's public GPT-5.6 Sol model to find and chain three unknown Chrome bugs into an exploit that took over a Windows PC when the user merely loaded a web page, escaping both of Chrome's sandboxes. The researchers chose targets and checked the work; the agents searched code, tested and drafted the exploits. It took six days and about $40,000 of computing, and earned Google's top $250,000 Chrome bounty. The bugs were never used in attacks and are fixed in Chrome 152.0.7977.82 and later. The significance is the price: a full Chrome chain used to be months of elite work. As the lead researcher put it, six days and $40,000 "is not a lot of time or money when the payoff is a Chrome chain".

Who's exposed: nobody from these bugs, if Chrome has restarted since early September. The lasting point is that browser updates matter more every month, so let Chrome restart when it asks.

Nextcloud servers backdoored through the built-in office app#

Attackers have been planting web shells on self-hosted Nextcloud servers since 10 September through CVE-2026-110447, a flaw in the Built-in CODE Server app that provides in-browser document editing. A request with no login could run a shell command whenever the app's local document server was down, for example during a restart or upgrade. On one server the attackers went looking for passwords and crypto wallets. The fix, version 26.4.303, has been out since 11 September but needs Nextcloud 30 or newer.

Who's exposed: people and small organisations running their own Nextcloud with the built-in CODE app, which is a common home-lab and small-office setup. Upgrade or remove the app (disabling it is not enough), look for shx*.php files in its folder, and treat anything the server could read as possibly exposed. Users of a hosted Nextcloud should ask their provider.

Attackers heated French supermarket fridges to 50°C#

From the night of 11 October, attackers took remote control of refrigeration controllers made by Danfoss at hundreds of French supermarkets, switched fridges and freezers into defrost and pushed some to 50°C. Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc stores were hit and had to throw food away. How the attackers got in is not confirmed; the controllers are managed remotely by maintenance firms, and CERT-FR's main advice is not to expose them to the internet. Danfoss says two older models no longer get updates and should be replaced. Paris prosecutors have opened an inquiry.

Who's exposed: shoppers, only in the sense of wasted food and empty shelves. The real lesson is for any business with building or equipment controllers reachable online: someone else's maintenance connection is part of your attack surface.

Spyware delivered through targeted online ads, confirmed for the first time#

Citizen Lab linked infections at Al Jazeera to Candiru, an Israeli spyware maker, and showed how they were delivered: ads from a company called Discover-Tech carried a script that reported each device's advertising ID and IP address, and only devices picked as targets received the attack code. The ads themselves looked clean. At least 45 Al Jazeera devices were targeted in 2024 and 2025. Researchers recovered the spyware but not the exploit that broke in, so it is not known what was exploited or whether it is patched. Google and IAB Europe removed Discover-Tech from their vendor lists in early October.

Who's exposed: journalists, activists and officials who governments might target, not the general public. For everyone, it is one more reason to run a browser or extension that blocks ads, and deleting or resetting your phone's advertising ID removes the identifier these systems key on.

Patches to install before anyone exploits them#

A cluster of critical fixes landed this week for software that runs much of the web. None was reported exploited at the time of writing, but most of these products get attacked within days of a fix becoming public.

• GitLab: CVE-2026-97229, rated 10.0, can let an unauthenticated user run code on the server through a crafted regular expression in CI configuration. Fixed in 19.2.8, 19.3.5 and 19.4.2.
• Next.js: an out-of-band release fixes two 9.5-rated code execution bugs, one in use cache with Cache Components and one in SVG processing with sharp. Update to 16.4.1 or 15.5.28.
• Drupal: CVE-2026-108097, a critical core flaw reachable through some contributed modules, at least one path without login. Fixed in 11.4.10, 11.3.19 and 10.6.19.
• NGINX: five fixes in 1.30.6 and 1.31.7, three memory bugs that may allow code execution in specific configurations and a TLS bug that might skip client-certificate checks.
• curl: CVE-2026-92392, a use-after-free in HTTP/2 uploads shown to run code in a lab under strict conditions. Fixed in 8.23.0.
• Langflow: CVE-2026-105740, rated 9.9, lets any logged-in user run commands. Honeypots have logged more than 1,700 attempts, though no confirmed compromises. Fixed in 1.9.0.
• SAP Cloud SDK for Python: CVE-2026-89111, rated 10.0, can leak an app's OAuth credentials. Use 0.55.1 or later.
• Docker Hub: CVE-2026-105445 let tokens follow a converted account to a new owner. Fixed server-side; review and revoke tokens you do not recognise.

Who's exposed: developers and the teams running these platforms. If you only use websites built on them, there is nothing to do.

The week in CVEs#

Worth knowing about#

Microsoft and partners took down three phishing kits behind a billion messages. A court-authorised operation with Health-ISAC, Japan's JC3, Cloudflare and Proofpoint disrupted the CoGUI, Haozi and Iron Man System kits, which sent over a billion phishing emails and texts impersonating government, banking and delivery brands to more than 75,000 organisations since January. Kits like these reappear under new names, which is why passkeys matter: a passkey will not sign in to a fake site, however convincing it looks. Authenticator-app codes are strong but can still be typed into a fake page, and SMS codes are the weakest option.

Fake "your PC is locked" pages are being mass-produced. Infoblox traced a traffic system that has spun up more than 20,000 disposable pages on Cloudflare Pages since April, about 300 a day, showing full-screen fake Microsoft alerts that urge you to call a "support" number and install a remote-control tool. Visitors arrive from hacked WordPress sites, ads and spam. Microsoft never locks a PC through a web page; close the browser (force-quit if needed) and never call the number. The same system also routes people to the fake CAPTCHA scams we covered earlier.

The US shut down more than 40 laptop farms used by North Korean IT workers. The Justice Department charged 14 people and seized about 187 computers after September raids in Texas. US facilitators kept company laptops at home so North Koreans hired under fake identities appeared to work from the US, at more than 70 companies.

A record fine in Norway for passing on Grindr data. Norway's data protection authority fined Microsoft-owned Xandr €8.6 million for relaying Grindr users' data, including data revealing sexual orientation, to potentially thousands of ad companies through real-time ad auctions between 2018 and 2020. The regulator held Xandr jointly responsible for consent rather than letting it rely on Grindr. Xandr can appeal.

npm closes a package-hijacking gap, and GhostAction rolls on. GitHub tightened npm trusted publishing after researchers showed that over 1,500 packages could be taken over by claiming a freed GitHub repository name. Meanwhile GitGuardian put the GhostAction campaign we covered last week at about 1,900 compromised accounts and 30,000 targeted repositories; some victims were hit twice because they never rotated secrets exposed the first time. LG also fixed a chain of webOS flaws that gave root on some smart TVs from the same home network with no PIN; check your TV for a firmware update.

Summary#

1. Install the October Windows updates and restart. One fixed flaw is already used in phishing attacks.
2. Update WinRAR to 7.13 or later, or uninstall it. It never updates itself.
3. Hardware wallet from a Southeast Asian reseller? Don't set it up; if you did, move funds to a new wallet with a fresh recovery phrase. Buy direct from the maker.
4. Avoid no-name or look-alike Android phones, install apps only from Google Play, and ignore in-app "update" prompts.
5. ConnectWise or SkyKick customers: keep the apps disabled and review sign-ins, app credentials, admin roles and mail rules since 13 October.
6. Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, PAN-OS: patch now and check for compromise; BeyondTrust and Cisco appliances that were exposed may need rebuilding.
7. AOMEI Backupper users: look for the RadminComponentRuntime or NitroRuntime scheduled tasks.
8. Self-hosted Nextcloud with the built-in CODE app: upgrade to 26.4.303 or remove the app, and look for web shells.
9. Developers: patch GitLab, Next.js, Drupal, NGINX, curl, Langflow and the SAP Python SDK, and rotate any secrets that were ever exposed.

Once again the biggest risk came through access that was granted on purpose: a backup app with keys to hundreds of tenants, a remote support tool, a vendor's update server. If you are not sure which third-party apps and services can reach your Microsoft 365 or Google Workspace data, get in touch - bluwarden can help you inventory that access and cut it back to what you actually need.

This roundup is for general information and reflects public reporting as of 18 October 2026. Vulnerability details, patch versions and exploitation status change quickly; always confirm against the vendor's own advisory before acting.